[quickbeard]

Phase 4c, first deliverable — the original Phase 4 headline item, now layered on the working broker.

What

• parseBrokerRules (in @codev/sandbox): validates an object of name → upstream URL into broker routes — lowercase/digit/dash names, llm reserved for the gateway route, http(s) upstreams only. Throws on anything malformed so a bad config fails the sandbox start with the parse message — fail-closed and loud, never a silently smaller allowlist.
• Desktop: resolveSandboxEgress reads the optional sandbox-egress.json from the app's userData dir at every sandbox start and appends the rules to the gateway route. Example:

{ "npm": "https://registry.npmjs.org", "pypi": "http://mirror.corp/simple" }

Inside every sandbox each rule is reachable at http://127.0.0.1:8788/<name>/... on all three backends (same guest stub the LLM route uses). Upstream calls go through the same Electron net fetch — host proxy/PAC/trust roots apply. There is deliberately no general-proxy escape hatch.

Hand-editable file, no UI — matches how an admin would roll this out fleet-wide; a settings surface can come later.

Remaining 4c items and why they're not in this PR

• Unprivileged guest user: needs a uid-mapping design, not just a setpriv line — VZ's virtio-fs performs guest-side permission checks against host file uids, so a guest server at uid 1000 cannot write a workspace owned by host uid 501 (root currently masks this). Plan: carry the host uid into boot.json, remap the codev user at init, then drop privileges — an image respin, to be bundled with the next image build. WSL has the same shape via drvfs automount options in wsl.conf (also image-coupled).
• WSL egress firewall: Hyper-V firewall rules per distro need elevation and a Windows machine to verify; implementing blind risks breaking fleet egress. Needs a session with the Windows box.
• Resource limits: per-sandbox cpus/memory is real only on vz (WSL's .wslconfig limits are VM-global); worth doing together with the add-dialog fields.

Tests

New parseBrokerRules suite (valid, empty, array, bad name, reserved llm, non-http, non-string); package 89 pass / 2 skip; desktop typecheck green. CHANGELOG entry added. Fork-only files.

🤖 Generated with Claude Code